Ctrlk
Contact UsVisit GuardWare
linkedinyoutube
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Set Up Azure Key Vault

GuardWare PROTECT uses Azure Key Vault to store the encryption keys securely. Azure Key Vault is a cloud service that provides centralised, secure storage for secrets such as encryption keys, passwords, certificates, and connection strings. By integrating with Azure Key Vault, GuardWare PROTECT ensures that encryption keys are never exposed within the application environment and remain under strict access control.

You can set up Azure Key Vault manually through the Microsoft Azure Portal or through the Management Console.

We recommend setting up through the Management Console since it automates most of the required configurations.

Prerequisites

Before setting up Azure Key Vault, ensure you have:

  • An active Microsoft Azure subscription. We recommend using a Pay-As-You-Go subscription.

  • A Microsoft Azure account with the required administrative permissions to access the Azure portal (for example, Global Administrator or Key Vault Administrator).

  • The Owner role assigned to the admin for your Azure subscription. If the admin account does not have the Owner role, follow the steps below to assign it in the Azure portal.

Assign Owner role to Your Azure Subscription

  1. Log in to the Azure Portal and search and click Subscriptions.

  2. Select your subscription.

  3. Go to Access control (IAM) and click Role assignments.

  4. Check if the admin account used to set up the Key vault has the Owner permission. If not, click +Add > Add role assignment.

  5. In the Role tab, click Privileged administrator roles.

  6. Select Owner and click Next.

  7. In Assign access to, select User, group, or service principal.

  8. Click + Select members, search and select the user and click Select.

  9. Click Next.

  10. In What user can do, select Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended) and click Next.

  11. Review the details and click Review +assign.

Set up Azure Key Vault through the Management Console

GuardWare can automatically set up the required configuration for Azure Key Vault in your Azure environment, including creating an Azure Key Vault and assigning the necessary permissions.

1

Log in with Azure

  1. Navigate to PROTECT > Key Vault.

  2. Click Log in with Azure.

  3. Log in with your admin account.

  4. If your account is protected by multi-factor authentication (MFA), you'll need to approve the sign-in request. This might involve:

    1. Approving a notification in the Microsoft Authenticator app.

    2. Entering the code from your authenticator app.

    3. Responding to a text message or phone call, depending on your MFA settings.

  5. After authenticating, you'll see a permissions consent screen listing what PROTECT is requesting access to. Click Accept.

2

Create Azure Key Vault

  1. Subscription: Select your subscription.

  2. Resource group: Choose existing or create new. Copy and store the Resource group name; you’ll need it to set up PROTECT Management Console.

  3. Key vault name: Enter a unique name (e.g., gwprotect-vault-prod). Copy the name and store it securely. This is the AZURE KEY VAULT NAME that you’ll need to set up PROTECT Management Console.

  4. Region: Select the appropriate region.

  5. Pricing tier: Select your pricing.

  6. Click Create.

After the Key Vault is created, all the required Role-Based Access Control (RBAC) roles needed for GuardWare PROTECT to securely access the Key Vault, manage key operations, and control resource-level permissions are automatically assigned.

Set up Azure Key Vault through the Azure Portal

Before setting up, ensure you have:

  • An active Microsoft Azure subscription. We recommend using a Pay-As-You-Go subscription.

  • A Microsoft Azure account with the required administrative permissions to access the Azure portal (for example, Global Administrator or Key Vault Administrator).

  • The Owner role assigned to the admin for your Azure subscription. If the admin account does not have the Owner role, follow the steps here.

During this process, make sure to note down and securely store the following details, as they will be required later while setting up the PROTECT Management Console:

  • Azure Client ID (App ID)

  • Azure Subscription ID

  • Azure Key Vault Name

  • Resource Group

1

Integrate Microsoft 365

  1. In the Management Console, navigate to ORGANISATION > Integrations.

  2. In the Microsoft 365 Integration section, click Connect Microsoft 365 and follow the necessary steps. See Integration for more details.

Configuring Microsoft 365 successfully creates an application (Service Principal) in Azure and grants the required API permissions to the application:

2

Create a Key Vault

Azure Key Vault is where GuardWare PROTECT securely stores and manages the encryption keys used for data protection. By creating a dedicated Key Vault, you ensure sensitive keys remain under strict access control and are available only to the authorised Service Principal.

  1. Go to the Azure Portal, sign in with your Azure Administrator account, and search for Key vaults and click the first result.

  2. Click +Create.

  1. In Basics, configure:

    1. Subscription: Select your subscription.

    2. Resource group: Choose existing or create new. Copy and store the Resource group name; you’ll need it to set up PROTECT Management Console.

    3. Key vault name: Enter a unique name (e.g., gwprotect-vault-prod). Copy the name and store it securely. This is the AZURE KEY VAULT NAME that you’ll need to set up PROTECT Management Console.

    4. Region: Select the appropriate region.

    5. Pricing tier: Select your pricing.

  1. Click Next.

  2. In Access configuration, configure:

    • Permission model: Select Azure role-based access control.

  1. Click Review + Create and then click Create. The Create button may appear disabled for a few moments while Azure validates your configuration.

  2. After creating the Key vault, go to the Key vaults Overview page, and copy the Subscription ID and store it securely. This is the AZURE SUBSCRIPTION ID that you’ll need to set up PROTECT Management Console.

3

Assign RBAC Roles to the Application (Service Principal)

After creating the Key Vault, you must assign the required Role-Based Access Control (RBAC) roles to the Application, so GuardWare PROTECT can securely access the Key Vault, manage key operations, and control resource-level permissions when needed. These roles ensure the Service Principal has the minimum permissions necessary to perform encryption, decryption, and access management tasks without exposing broader access.

3.1. Assign the Key Vault Administrator role

This role is required so the Service Principal can fully manage the Key Vault, including creating, updating, deleting, and recovering keys, secrets, and certificates.

  1. Navigate to the Key Vault that you created and click Access control (IAM).

  2. Click Add and then Add role assignment.

  3. Search and select the Key Vault Administrator role and click Next.

  4. In Assign access to, select User, group, or service principal.

  5. Click + Select members, search and select the application created during the Microsoft 365 integration (for example, GuardWare M365 Monitor).

    If you are unsure of the application name, go to ORGANISATION > Integrations, copy the Client ID or Tenant ID, and use it to search for the application in the Microsoft Azure Portal under App registrations > All applications.

  6. Click Next and then Review + assign.

3.2. Assign the User Access Administrator role

This role is required so the Service Principal can manage access permissions on the resource. With this role, it can grant, modify, or revoke user and service access when needed, ensuring the correct identities have the appropriate permissions.

  1. Navigate to the Key Vault that you created and click Access control (IAM).

  2. Click Add and then Add role assignment.

  3. Click Role assignments and then Privileged administrator roles.

  4. Search and select the User Access Administrator role and click Next.

  5. In Assign access to, select User, group, or service principal.

  6. Click + Select members, then search and select the application created during the Microsoft 365 integration (for example, GuardWare M365 Monitor).

    If you are unsure of the application name, go to ORGANISATION > Integrations, copy the Client ID or Tenant ID, and use it to search for the application in the Microsoft Azure Portal under App registrations > All applications.

  7. Click Next.

  8. In What user can do, select the second option: Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended) and click Next.

  9. Click Review + assign.

3.3. Assign the Role-Based Access Control Administrator

This role is required so the Service Principal can not only access the Key Vault, but also update or manage key-related permissions within the resource when necessary.

  1. Navigate to the Key Vault that you created and click Access control (IAM).

  2. Click Add and then Add role assignment.

  3. Click Privileged administrator roles.

  4. Search and select the Role Based Access Control Administrator role and click Next.

  5. In Assign access to, select User, group, or service principal.

  6. Click + Select members, search and select the application created during the Microsoft 365 integration (for example, GuardWare M365 Monitor).

    If you are unsure of the application name, go to ORGANISATION > Integrations, copy the Client ID or Tenant ID, and use it to search for the application in the Microsoft Azure Portal under App registrations > All applications.

  7. Click Next.

  8. In What user can do, select the second option: Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended) and click Next.

  9. Click Review + assign.

PreviousPROTECT FeaturesNextSecurity Groups

Last updated